wpscan published 10 vulnerabilities i found and reported, all in one plugin: security for woocommerce (ultimate security for woocommerce), versions <= 1.0.16. no fix is available.
the 10, all unauthenticated, all credited to me on wpscan:
- CVE-2026-123696 - two-factor authentication reset - https://wpscan.com/vulnerability/60efadce-ae1b-448c-9e9c-aa65ee5e028d
- CVE-2026-123697 - two-factor code and secret disclosure - https://wpscan.com/vulnerability/58f2562b-e108-46ab-92bb-3430109dab1f
- CVE-2026-123698 - plugin settings disclosure via REST API - https://wpscan.com/vulnerability/f13ecbe7-8abb-4736-be5c-fd38f402181c
- CVE-2026-123699 - forced plugin, theme and core updates - https://wpscan.com/vulnerability/344ca520-dc28-4d52-a400-559d23359d23
- CVE-2026-123700 - mass comment deletion - https://wpscan.com/vulnerability/3facdee3-eb7e-458c-b496-9946f8e2d1f0
- CVE-2026-123701 - plugin settings reset - https://wpscan.com/vulnerability/9d65f64f-b9d5-488d-a81d-4013a1b1fc9e
- CVE-2026-123702 - wp-config keys and salts reset and denial of service - https://wpscan.com/vulnerability/28de2af4-74aa-497d-9f1a-69d40c72fea5
- CVE-2026-123703 - arbitrary user logout - https://wpscan.com/vulnerability/6b255385-26ae-416c-8c2d-a673508aa212
- CVE-2026-123704 - administrator email address disclosure - https://wpscan.com/vulnerability/b7e8fa76-32c0-48ea-a685-2a75ffe94cd1
- CVE-2026-123705 - server configuration information disclosure - https://wpscan.com/vulnerability/cb9bbd7a-c13a-4129-a910-45746af203ce
i audited the plugin, proved each finding, then reported them. no proof, no report.
the same list is on my research page: https://benihacking.top/research.html
separate lane, same rule as the PR work: find it, prove it, report it. 50 merged PRs so far. going to 100.
Top comments (0)